Binance reopens withdrawals after $6.3bn hack as customers move billions

Binance has resumed withdrawals in stages after a record cyberattack affecting an estimated $6.3bn in digital assets, with customers moving about $3.6bn away from the cryptocurrency exchange as access was restored. The withdrawals followed a temporary suspension imposed after last week’s breach. The Guardian said Binance had processed $4.6bn in withdrawals and $1bn in deposits by Sunday afternoon, producing a net outflow of approximately $3.6bn.

That represented about 2.1% of the exchange’s reported $171bn in assets under management. The BBC also reported withdrawals of more than $3.6bn, describing an initial surge that later eased. Binance said withdrawals for major currencies, including Bitcoin and Ethereum, had resumed, while other networks and assets would return after additional security checks.

The Guardian reported that the first phase covered 15 networks and assets, including Ethereum, USDT and USDC tokens on the Ethereum blockchain and selected assets held on the BNB Smart Chain. Dogecoin and Avalanche trading later resumed on their own networks. The company said it had replaced about 90% to 95% of the stolen assets.

Binance said the remaining tokens were less liquid and could take longer to obtain, but co-chief executive Richard Teng pledged that customers would not bear the financial cost. The exchange has repeatedly said it will cover the full loss. Binance said it had set aside roughly $6.34bn in corporate funds for the incident.

The Guardian reported that the company was using part of its $1bn secure-asset fund for users, a futures insurance fund and its own treasury to buy back tokens. A complete report on the attack was expected on Monday, according to that account. The FBI said a North Korea-linked group known as TraderTraitor was responsible for stealing more than $6bn in virtual assets from Binance on or around 29 October.

The agency said it had observed the attackers converting assets into Ethereum and expected further laundering through decentralised-finance platforms and instant-swap services. It urged private companies to block transactions connected to addresses used by the group. The attribution followed earlier assessments by private investigators and analysts.

The Guardian said TraderTraitor is believed to be linked to the Lazarus Group, which has previously been accused of attacks including the 2014 breach of Sony Pictures. Binance co-chief executive Teng described the latest breach as a complex attack involving a compromised laptop and malicious software intended to erase evidence. The incident unsettled cryptocurrency markets.

Bitcoin fell nearly 5% after news of the hack, Ethereum dropped almost 6%, and Binance’s own BNB token declined close to 10%. The scale of the theft has renewed attention on North Korea’s ability to raise money through cybercrime while facing extensive international sanctions over its nuclear and missile programmes. Binance said withdrawal volumes had declined and were stabilising, while deposits remained substantial.

The exchange said it was testing the remaining networks and assets before expanding services, leaving some parts of the platform subject to a phased reopening rather than an immediate return to normal operation.